CVE-2026-8293: Really Simple Security Authentication Bypass via 2FA Challenge Skip

HERMES

HERMES THREAT SCORE & ENTERPRISE CMS COMPROMISE

Target: Really Simple Security WordPress Plugin

Confidence: 97%

86 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 17 / 20

Weaponization 18 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 19 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 18 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-8293 at 7.5 High (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score assesses it at 86 (HIGH). While exploiting the bypass requires credential access, the total circumvention of Two-Factor Authentication (2FA) in enterprise security plugins directly dismantles the defense-in-depth architecture protecting administrative portals.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-8293: Really Simple Security Authentication Bypass via 2FA Challenge SkipVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTReally Simple Security

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Really Simple Security documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CVE-2026-8293 is an authentication bypass vulnerability in the Really Simple Security plugin for WordPress. The plugin, deployed on over 4 million WordPress sites, includes built-in Two-Factor Authentication (2FA) with email OTP verification.

The vulnerability exists in two custom REST API endpoints responsible for authenticating users undergoing multi-factor verification. When a user presents valid primary credentials (username and password), the plugin fails to enforce state verification prior to creating a full WordPress user session. By directly hitting the secondary verification endpoint without supplying the one-time passcode (OTP), an attacker possessing leaked or brute-forced credentials can establish an authenticated administrative session, completely neutralizing the multi-factor protection.

1. Technical Context & Affected Software Matrix

Really Simple Security is one of the most widely deployed security suites in the WordPress ecosystem, managing HTTPS redirection, security headers, vulnerability monitoring, and two-factor authentication.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	`CVE-2026-8293`	Official NVD & WPScan advisory
Common Weakness Enumeration	`CWE-287` (Improper Authentication)	Incomplete 2FA state machine enforcement in REST controllers
Network Vector	HTTP/HTTPS (`80/TCP`, `443/TCP`)	REST API POST to `/wp-json/reallysimplessl/v1/two_factor/`
Vulnerable Component	`TwoFactorRestController`	2FA verification callback handlers
Affected Versions	`< 9.5.10.1`	Installations utilizing email 2FA
Remediated Versions	`9.5.10.1`	Security maintenance release

2. Vulnerability Mechanism & Root Cause Analysis

Missing Enforcement in REST 2FA Handlers

The plugin registers a REST route intended to finalize login after OTP verification. However, the handler failed to ensure that the OTP challenge had actually succeeded before invoking wp_set_auth_cookie():

// Vulnerable logic in Really Simple Security < 9.5.10.1
public function verify_two_factor_session( $request ) {
    $user_id = $request->get_param( 'user_id' );
    $login_nonce = $request->get_param( 'login_nonce' );

    // Flawed validation: if login_nonce is present from stage 1,
    // it verified the temporary nonce but did not check if otp_verified == true
    if ( $this->validate_login_nonce( $user_id, $login_nonce ) ) {
        // Vulnerable: sets full authentication cookie without checking OTP code!
        wp_set_current_user( $user_id );
        wp_set_auth_cookie( $user_id, true );
        return new WP_REST_Response( [ 'success' => true, 'redirect' => admin_url() ] );
    }

    return new WP_REST_Response( [ 'success' => false ], 403 );
}

Because validate_login_nonce() merely validated that the user completed password authentication in step 1, skipping the OTP submission allowed immediate generation of the administrative authentication cookie.

3. Threat Hunting & Detection

Suricata Network Rule

alert http any any -> $HTTP_SERVERS any (
  msg:"HERMES EXPLOIT - Really Simple Security 2FA Challenge Bypass (CVE-2026-8293)";
  flow:to_server,established;
  http.uri; content:"/wp-json/reallysimplessl/v1/two_factor/"; nocase;
  http.request_body; content:"login_nonce=";
  content:!"otp_code=";
  classtype:web-application-attack;
  sid:20268293; rev:1;
)

4. Remediation Playbook

Update Really Simple Security: Update the plugin immediately to version 9.5.10.1 or later:
Terminal window
```
wp plugin update really-simple-ssl
```
Audit Administrative Passwords: Because exploitation requires valid primary credentials, force a site-wide password reset for all administrators.
Deploy Web Application Firewall (WAF): Ensure WAF rules inspect calls to /wp-json/reallysimplessl/v1/two_factor/ to enforce OTP presence.

5. Verification & Cross References

WPScan Vulnerability Advisory
Software Intelligence: Really Simple Security Plugin